docs(tac): post-merge TAC reconciliation snapshot (34 trees, by owner) - #1876
Conversation
Full TAC audit across all 34 trees after this session's merges. Routes work by agent_hint owner (Village Rule — no edits to other lanes' trees). Findings: firefly-iii/pmoves-launch-readiness clean; agent-zero-customization (35 fail) / mcp-topology (12) / observability (10) need grep-first reconciliation (likely stale patterns); 9 trees never-run. 4090-lane: cast-gateway 2 fails = real compose-hardening gaps (fold into compose-hardening PR); node-4090-laptop all runtime checks (needs live sitrep, not stale). Proposes new security-posture/ networking nodes for this session's daemon-hardening (#1869) + no-volume-prune (#1868), and re-scoping github-app runner-auth per the §4 PAT-for-GHCR decision. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughA new handoff document ChangesTAC Refresh Handoff Document
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b2204c086c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - **cast-gateway** (35/2): both fails are **real compose-hardening gaps**, not | ||
| stale checks — `cg.health.hardening` wants the `tier-agent-hardened-ro` anchor | ||
| on `cast-tts-gateway` in `docker-compose.yml`, and `cg.security.container` | ||
| wants the nonroot `65532` user. These belong in the **deferred compose- |
There was a problem hiding this comment.
In the reviewed tree, cast-tts-gateway already has the hardening anchor and non-root user (pmoves/docker-compose.yml lines 3602 and 3617). The two TAC failures come from grep patterns that require the service name and target text on the same line, so treating them as real compose-hardening gaps sends the 4090 owner to change an already-hardened service instead of fixing/re-scoping the TAC checks.
Useful? React with 👍 / 👎.
* fix(tac): cast-gateway hardening checks use multiline-safe regex The cast-tts-gateway service in pmoves/docker-compose.yml is ALREADY hardened — `<<: *tier-agent-hardened-ro` (line 3491) + `user: "65532:65532"` (line 3506). The two TAC checks (cg.health.hardening, cg.security.container) were false-failing because tac_runner's re.search runs without DOTALL, so the old `cast-tts-gateway.*<token>` patterns could never match across YAML lines. Reconcile the CHECKS to reality (not the other way round): bounded `[\s\S]` spans match within the service block while staying short of the next service, so the checks keep their teeth (verified: they fail if the anchor/uid are removed). cast-gateway tree now 37 pass / 0 fail (was 35/2). Supersedes the "real compose-hardening gaps" note in TAC_REFRESH_2026-06-23 (#1876) — that classification was made without reading the compose block; the hardening was present all along. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(tac): anchor cast-gateway hardening regex to service key line Addresses Codex P2: the bounded `[\s\S]` patterns weren't anchored to the YAML service header, so a rename that kept the `pmoves-cast-tts-gateway:` image tag could false-pass the service-block audit. tac_runner's re.search has no re.MULTILINE, so `^\s{2}` can't anchor — use a literal `\n ` (newline + 2-space indent) to pin to the service KEY line instead of the image value. Verified: matches the current block, fails on anchor/uid removal (teeth), and no longer matches when the service key is renamed but the image tag remains. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
1 participant
Why
TAC tree refresh after this session's branch updates (#1868/#1869/#1872 + Jellyfin sync). Full audit across all 34 trees via
tac_runner.py, routed byagent_hintowner — Village Rule, so this snapshot reports state and assigns work without editing other lanes' trees.Key findings
firefly-iii,pmoves-launch-readiness.agent-zero-customization(35),mcp-topology(12),observability(10),dox-intelligence(7) — all codex-owned.cast-gateway2 fails = real compose-hardening gaps (tier-agent-hardened-roanchor + nonroot65532oncast-tts-gateway) → fold into the deferred compose-hardening PR (Docker audit P2);docker-compose.ymlis basename-protected, so it's a deliberate change, not a tree edit.node-4090-laptopall-pending = runtime/manual checks (not stale) → needs a livenode-4090-sitrep, not a tree edit.security-posture/networking-defense-in-depth.gh-app.runners.app-auth— §4 decided GHCR push uses a classic PAT by design (App can't write user-namespace packages), so it's superseded for that path.Scope
Docs-only (4090 deploy-spine authoring a fleet status doc). No tree edits, no infra touch. Actionable per-owner ordering at the bottom of the doc.
🤖 Generated with Claude Code
Summary by CodeRabbit